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Over the past decades, coordination languages have emerged for the specification and implementation 
of interaction protocols for communicating software components. This class of languages includes 
Reo, a platform for compositional construction of connectors. In recent years, various formalisms 
for describing the behavior of Reo connectors have come to existence, each of them serving its own 
purpose. Naturally, questions about how these models relate to each other arise. From a theoretical 
point of view, answers to these questions provide us with better insight into the fundamentals of Reo, 
while from a more practical perspective, these answers broaden the applicability of Reo's develop- 
ment tools. In this paper, we address one of these questions: we investigate the equivalence between 
coloring models and constraint automata, the two most dominant and practically relevant semantic 
models of Reo. More specifically, we define operators that transform one model to the other (and 
vice versa), prove their correctness, and show that they distribute over composition. To ensure that 
the transformation operators map one-to-one (instead of many-to-one), we extend coloring models 
with data constraints. Though primarily a theoretical contribution, we sketch some potential appli- 
cations of our results: the broadening of the applicability of existing tools for connector verification 
and animation. 

1 Introduction 

Over the past decades, coordination languages have emerged for the specification and implementation 
of interaction protocols for communicating software components. This class of languages includes Reo 
O, a platform for compositional construction of connectors. Connectors in Reo (or circuits) form the 
communication mediums through which components can interact with each other. Essentially, Reo cir- 
cuits impose constraints on the order in which components can send and receive data items to and from 
each other. Although ostensibly simple, Reo connectors can describe complex protocols (e.g., a solution 
to the Dining Philosophers problem O). In recent years, various formal models for describing the be- 
havior of Reo circuits have arisen, including a coalgebraic model [4], various operational models (e.g., 
constraint automata [6|), and two coloring models |8| (we mention more models in Section IT]). Each of 
these formalisms serves its own purpose: the coalgebraic model has become Reo's reference semantics, 
constraint automata play a dominant role in connector verification (e.g., the Vereofy model checker Q), 
and the coloring models facilitate the animation of connectors (e.g., the implementation of the work in 
Chapter 6 of |9| in the Eclipse Coordination Tools). 

Having this wide variety of semantic models, questions about how they relate to each other natu- 
rally arise. We identify two reasons for why this question, moreover, requires answering. First, from 
a purely theoretical point of view, answers provide us with better and possibly new insights into Reo's 
fundamentals. Second, from a more practical perspective, such answers broaden the applicability of 
tools — both existing and future — that assist developers in designing their Reo circuits. For instance, the 
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correspondence between constraint automata and the coloring model with two colors (the topic of this 
paper) enables us to, on the one hand, model check connectors with a coloring model as their formal 
semantics, and, on the other, animate connectors with a constraint automaton as their behavioral model. 
We consider this important because contemporary tools for verification and animation cannot operate on, 
respectively, coloring models and constraint automata. 

Contributions We investigate the relation between coloring models with two colors and constraint 
automata. We show how to transform the former to the latter and demonstrate bi-similarity between an 
original and its transformation. In the opposite direction, we show how to transform constraint automata 
to equivalent coloring models, prove that these transformations define each other's inverse, and again 
show bi-similarity. Additionally, we prove the compositionality of our transformation operators. To 
ensure that our transformation operators map one-to-one (instead of many-to-one), we extend coloring 
models with data constraints. To illustrate the practical relevance of our work, we sketch one of its 
applications: the integration of verification and animation of context-sensitive connectors in Vereofy. We 
emphasize, however, that with this paper, we aim at establishing equivalences: we consider it primarily 
a theoretical contribution and a formal foundation for future tool development. 

Organization In Section [2l we discuss preliminaries of Reo. In Section [3l we extend coloring models 
with data constraints. In SectionlH we present a transformation from such data-aware coloring models to 
constraint automata, and in Section[5l we present a transformation in the opposite direction. In Section|6l 
we sketch an application of our results. Section|7] concludes the paper and includes related work. 

2 Connector Structures, Coloring Models, and Constraint Automata 

In this section, we discuss the essentials of Reo (relevant to this paper): the structure of circuits and two 
formal models of its behavior. Henceforth, we write "connector" or "circuit" to refer to both the structure 
and the intended behavior of a communication medium between software components. 

2.1 Connector Structures 

We start with the structure of circuits. A Reo connector consists of nodes through which data items can 
flow. We distinguish three types of nodes: input nodes on which components can issue write requests 
for data items, internal nodes that the connector uses to internally route data items, and output nodes on 
which components can issue take requests for data items. We call input and output nodes collectively, 
the boundary nodes of a connector Write and take requests, collectively called I/O requests, remain 
pending on a boundary node until they succeed, in which case their respective nodes fire. We describe 
the structure of a connector formally as a set of nodes, typically denoted as N, and a binary relation on 
these nodes, typically denoted as E. We use this relation to specify the direction of the flow through the 
nodes in N: if {ni„,nout) € E, this means that node can route incoming data items from itself to ?io«f- 

Definition 1 (Universe of nodes). Node is the set of nodes. 

Definition 2 (Connector structure). A connector structure G is a pair {N,E) with N C Node a set of 
nodes and E QN x N a relation such that n implies {nin,n) £ E or {n,nout) G E. 

The side condition in the previous definition ensures that a connector structure does not include super- 
fluous nodes through which data items never flow (note that it does allow for cyclic structures). We 
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Figure 1: Pictorial representation and formal definition of the structure of Sync, LossySync, and FIFO. 

associate the following sets and definitions with a connector structure a = {N,E). First, we define the 
sets of its input, output, and internal nodes. 

inputfj = {neN \ {nin,n) ^E} 
output^ = {iieN \ {n,nout) ^E} 
internalfj = {« G | «), G £ } 

Note that these three definitions specify mutually disjoint sets and that their union equals N (due to the 
side condition in Definition [J]). If internal^ = 0, the circuit whose topology a describes belongs to the 
class of connectors called primitives, the most elementary mediums between components. 

To illustrate the previous definition. Figure [T] shows pictorial representations and formal definitions 
of the structures of three common (binary) primitives. Because the pictorial representations of these 
primitives may give away some hints about their behavior, we discuss these informally here; the formal 
definitions appear later in this section. The Sync primitive consists of an input node and an output node. 
Data items flow through this primitive only if both of its nodes have pending I/O requests. The LossySync 
primitive behaves similarly, but loses a data item if its input node has a pending write request while its 
output node has no pending take request. In contrast to the previous two primitives, connectors can have 
buffers to store data items in. Such connectors exhibit different states, while the internal configuration of 
Sync and LossySync always stays the same. For instance, the FIFO primitive consists of an input node, an 
output node, and a buffer of size 1. In its EMPTY state, a write request on the input node of FIFO causes 
a data item to flow into its buffer — i.e., this buffer becomes full — while a take request on its output node 
remains pending. Conversely, in its FULL state, a write request on its input node remains pending, while 
a take request on its output node causes a data item to flow from the buffer to this output node — i.e., 
the buffer becomes empty. Finally, note the equality of the formal definitions of the structures of Sync, 
LossySync, and FIFO: {{A,B},{{A,B)}). In general, all primitives that route data items from a single 
input node to a single output node have this structure (up to node renaming). 

We can construct complex connectors from simpler constituents (e.g., instances of primitives) using 
composition. Connector structures Oi and 02 can compose if each of their shared nodes serves as an input 
node in Oi and as an output node in 02 or vice versa. To compose such compatible connector structures, 
we merge their sets of nodes and E relations. 

Definition 3 (Composition of connector structures). Let Oi = {Ni,Ei) and 02 = (A'^zi^i) be connec- 
tor structures such that N\r\N2 = (input n output g.^) U (input fl output ^^J. Their composition, 
denoted 0\ Kl 02, is a connector structure defined as: 

ai S 02 = (A^i UN2,Ei UE2) 

To illustrate the previous definition. Figure [2] shows the pictorial representation and formal definition of 
the structure of LossyFIFO, a connector composed of LossySync and FIFO. The LossyFIFO connector 
consists of one input node, one internal node, and one output node. Similar to FIFO, the LossyFIFO 
connector exhibits the states EMPTY and FULL. Informally, in the EMPTY state, a write request on the 
input node of LossyFIFO always causes a data item to flow into its buffer, while a take request on its 
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Figure 2: Pictorial representation and formal definition of the structure of LossyFIFO. 



output node remains pending. In the FULL state, a write request on its input node always causes a data 
item to flow from its input node towards its buffer, but gets lost before reaching its internal node; a take 
request on its output node causes a data item to flow from its buffer to this output node. 

Later in this paper, we use the possible compatibility between two connector structures as a well- 
formedness condition to define the composition of various comprehensive models — models that combine 
a connector structure with a behavioral model — of Reo connectors. 

2.2 Coloring Models 

We proceed with coloring models |l8l|9l as the first semantic model we discuss. Coloring models work 
by marking nodes of a connector with colors that specify whether data items flow through these nodes or 
not. Depending on the number of colors, different models with different levels of expressiveness arise. 

In this paper, we assume a total of two colors: \heflow color (data items can flow through the 

nodes it marks) and the no-flow color (data items cannot flow through the nodes it marks)Q To 

describe a single behavior alternative of a connector in a given state, we define colorings: maps from 
sets of nodes to sets of colors, which assign to each node in the set a color that indicates whether this 
node fires (or not) in the behavior that the coloring describes. We collect all behavior alternatives of a 
connector in sets of colorings called coloring tables. 

Definition 4 (Colors |8 |). Color = { , } is a set of colors. 

Definition 5 (Coloring [8]). Let N C Node. A coloring c over N is a map N — )• Color. 

Definition 6 (Coloring table jUl). Let N C Node. A coloring table T over N is a set {N ^ Color} of 
colorings over N. 

To accommodate connectors that exhibit different behavior in different states (e.g., connectors with 
buffers to store data items in), we use coloring table maps (CTM): maps from sets of indexes (repre- 
senting the states of a connector) to sets of coloring tables (describing the allowed behavior alternatives 
m these states)! Subsequently, to model the change of state a connector incurs when (some of) its nodes 
fire, we use next functions. The next function of a connector maps an index A in the domain A of a CTM 
S and a coloring in the coloring table to which 5 maps A to some index in A (possibly the same A). 

Definition 7 (Universe of indexes). Index is the set of indexes. 

Definition 8 (Coloring table map 111). LetN C Node and A. C Index. A coloring table map S over [N,A] 
is a total map 5 : A — > 2{'^^'-°'°''} from indexes to coloring tables over N. 

Definition 9 (Next function ||9l). Let S be a CTM over [A'^, A]. A next function r\ over S is a partial map 
A X {A^ Color} ^ Afrom [index, coloring ]-pairs to indexes such that [A,c i— )• A'] € TJ iffc € 5(A). 

'Two colors yield the 2-coloring model. Alternatively, the 3 -coloring model features three different colors to mark nodes 
with. Although many believe that the 3-coloring model has a higher degree of expressiveness than the 2-coloring model, a 
recent investigation 1 10] suggests otherwise. 

^In (9), Costa calls coloring table maps indexed sets of coloring tables. 



88 



Correlating Formal Semantic Models of Reo Connectors 



Sync 



C4 



S ={Sync H- {ci,C4}} 



„ ^ r(Sync,C|) M-Sync 
\ (Sync,C4) Sync 



Ao = Sync 



LossySync 



C4 



S ={LSynci-> { 



Cl,C2,C4 



}} 



f(LSync, C| ) i-^ LSync , 
(LSync.c?) M- LSync , 
(LSync, C4) M- LSync ^ 

Ao = LSync 



FIFO (Empty) 




C2 
C4 



C3 
C4 



^ rFIF0-Eh^{c2,C4} 
\FIFO-Fh^ {C3,C4} 



(FIF0-E,C2> FIFD-F . 
(FIF0-E,C4) i-> FIFD-E . 

(FIF0-F,C3) i-> FIFD-E . 
(FIF0-F,C4) ^ FIFD-F 

Ao = FIFO-E 



Figure 3: Colorings, CTMs, and initialized next functions of Sync, LossySync, and FIFO. 



Next, we slightly extend the connector coloring framework as presented in [Si [3 by introducing initial- 
ized next functions. Suppose a CTM S over [N,A\ and a next function 77 over 5: an initialization of 
7] — formally a pair of a next function and an index — associates T] with some Ao G A. This Ao represents 
the initial state of the connector whose behavior r\ models. 

Definition 10 (Initialized next function). Let She a CTM over [A'^, A]. An initialized next function e over 
S is a pair (t], Ao) with t] a next function over S and Ao G A. 

Finally, we join coloring models — i.e., initialized next functions, which comprehensively describe the 
behavior of circuits — and connector structures in e-connectors: complete formal models of connectors. 

Definition 11 (£-connector). Let N C Node and let S be a CTM over [A'^, A]. An e-connector over 
[N,S] is a pair (cT,e) with a = {N,E) a connector structure and £ an initialized next function over S. 

To illustrate the previous definitions. Figure [3] shows the coloring models that describe the behavior of 
Sync, LossySync, and FIFO, whose structures we depicted in Figure 

When we compose two connectors that have coloring models as formal semantics, we can compute 
the coloring model of the composed connector by composing the coloring models of its constituents. 
We describe this composition process in a bottom-up fashion. First, to compose two compatible color- 
ings — i.e., colorings that assign the same colors to their shared nodes — we merge the domains of these 
colorings and map each node n in the resulting set to the color that one of the colorings assigns to n. The 
composition of two coloring tables then comprises the computation of a new coloring table that contains 
the pairwise compositions of the compatible colorings in the two individual coloring tables. 

Definition 12 (Composition of colorings 111). Let ci and C2 be colorings over Ni and N2 such that 
ci{n) = C2{n) for all n £ Ni nA^2- Their composition, denoted by ci Uc2, is a coloring over Ni L)N2 
defined as: 

'ci{n) ifneNi \ 



Ci U C2 = S « 1-^ K" 



n GNi [JN2 and K - 



C2(n) otherwise J 



■^Because a composed connector may consist of multiple instances of the same (primitive) connector, we should actually 
use indexes that enable distinguishing between such instances. For example, rather than just "Sync", we could extend this 
index with a distinctive subscript, such as the set of nodes that the respective Sync primitive connects (e.g., "Sync^ g") or, 
alternatively, an integer (e.g., "Syncj"). Throughout this paper, however, we abstract from such subscripts for notational 
convenience. 
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Definition 13 (Composition of coloring tables ||8l). Let Ti and T2 be coloring tables over Ni and N2- 
Their composition, denoted by Ti ■ T2, is a coloring table over Ni L)N2 defined as: 

Ti ■T2 = {ci Uc2 I Cl G Ti and C2 G T2 and c\{n) = C2{n) for all n PlA'^i} 

Next, the composition of two CTMs comprises the computation of a new CTM that maps each pair of 
indexes in the Cartesian product of the domains of the two individual CTMs to the composition of the 
coloring tables to which these CTMs map the indexes in the pair. We define the composition of two next 
functions in terms of the Cartesian product, the composition of colorings, and the composition of CTMs. 

Definition 14 (Composition of CTMs gl). Let Si and S2 be CTMs over [Ni,Ai] and [A^2,A2]- Their 
composition, denoted by Si G1S2, is a CTM over [Ni UA'^2,Ai x A2] defined as: 

5i 052 = {(Ai,A2)^5i(Ai) -52(^2) I Ai G Aj andX2eA2} 

Definition 15 (Composition of next functions 191). Let rji and r\2 be next functions over Si and S2 with 
Si and S2 defined over [A'^ijAi] and [A'^2)A2]. Their composition, denoted by Tji T]2, is a next function 
over Si ^2 defined as: 



(Ai,A2) G Ai X A2 
and 

C1UC2G (5i052)((Ai,A2)), 



{Ai,A2),Ci UC2 
^ (T]i(Al,Cl),T]2(A2,C2)) 

We define the composition of initialized next functions in terms of the composition of next functions and 
take the pair of the initial states as the initial state of the composition. 

Definition 16 (Composition of initialized next functions). Let £1 = (t]i , Aq ) and 82 = (t]2, Aq ) be initial- 
ized next functions over Si and S2. Their composition, denoted by £1 £2, is an initialized next function 
over Si ^2 defined as: 

ei(^e2 = (rii^mAK^^i)) 
Finally, we define the composition of e -connectors in terms of the composition of connector structures 
and the composition of initialized next functions. 

Definition 17 (Composition of £-connectors). Let = {ai,£i) and 'i^2°' — {'^2,^2) be £-connectors 
over [Ni,Si] and [A^25'^2] such that Gi Kl 02 is defined. Their composition, denoted by x '(^2^°', is an 
£-connector over [Ni UN2,Si QS2] defined as: 

^coi X ^c°i = S 02, £1 £2) 

To illustrate the previous definitions. Figure |4] shows a coloring model that describes the behavior of 
LossyFIFO, whose structure we depicted in Figure [2] In this figure, the index of a coloring specifies its 
origin: a coloring results from composing c,- (of LossySync) with cj (of FIFO) in Figure l3li 

2.3 Constraint Automata 

We end this section with constraint automata (CA) f^l as the second semantic model we discuss. A CA 
consists of a (possibly singleton) set of states, which correspond one-to-one to the states of the connector 
whose behavior it models and a set of transitions between them; in contrast to standard automata, CA 



^Note that this composed coloring model of LossyFIFO does not describe its intended behavior as outlined near the end of 
the previous subsection: coloring C24, allowed in the EMPTY state according to the composed model, describes the loss of a 
data item between A and M. We, however, consider this inadmissible behavior in the EMPTY state. Clarke et al. recognize this 
inconsistency between intuition and formal practice in 1 8 1 and call it the problem of describing context-sensitive connectors. 
We refer the reader interested in the challenges that context-sensitive connectors entail to f7l[8][9i nol . 
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Ao = LFIFO-E 



■n =■ 



Figure 4: Colorings, CTM, and next function of LossyFIFO. We abbreviate (LSync,FIFO-E) by 
LFIFO-E and (LSyiic,FIFO-F) by LFIFO-F. 



do not have accepting states. A transition of a CA carries a label that consists of two elements: a set of 
nodes and a data constraint. The former, called a firing set, describes which nodes fire simultaneously 
in the state the transition leaves from; the latter specifies the conditions that the content of the data items 
that flow through these firing nodes must satisfy. To define (the universe of) data constraints, we assume 
a universe of data items. This set contains every data item that we may send through a Reo connector. 

Definition 18 (Universe of data items). Data is the set of data items. 

Definition 19 (Universe of data constraints |[6l). Constraint is the set of data constraints such that each 
g € Constraint complies with the following grammar: 

g ::= g A g \ -tg \ T \ #n = d with n G Node and d G Data 

Informally, #n means "the data item that flows through n", while A, -■, and T have their usual meaning. 
For convenience, we also allow their derived Boolean operators such as V, (implication), etc., as syn- 
tactic sugar; we adopt #ni = #/i2 (with ?ii,«2 G Node) as an abbreviation of VrfeData(#'^i = d A#n2 = d). 
This gives us sufficient machinery to define CA. Recall that CA serve as operational models of connector 
behavior — their states correspond one-to-one to the states of a connector, while their transitions specify 
for each state when and what data items can flow through which nodes. 

Definition 20 (Constraint automaton |[6l). Let N C Node and G C Constraint. A constraint automaton 
cc over \N ,G] is a tuple {Q,R,qo) with Q a set of states, R'^Qxl^xGxQa transition relation, and 
qo & Q an initial state. 

As initialized next functions, CA comprehensively model circuit behavior. Similar to £-connectors, 
therefore, we introduce a-connectors: pairs that consist of a connector structure and a CA. 

Definition 21 (a-connector). Let N C Node and G C Constraint. An a-connector 'lo^'^ over [N,G] is a 
pair (cT,a) with o = {N,E) a connector structure and a = {Q,R,qo) a CA over [N,G]. 

To illustrate the previous definitions, the CA of Sync, LossySync, and FIFO appear in Figured For 
simplicity, we assume the universe of data items a singleton with the string "foo" as its sole element. 
In general, the CA of FIFO contains a distinct state for each data item in Data that may occupy its 
buffer. Note that rather than naming states symbolically (e.g., q,p,qo,qi,...), we name states by the same 
indexes we encountered previously when defining coloring table maps in coloring models. Henceforth, 
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Figure 5: Constraint automata of Sync, LossySync, and FIFO with Data = {"foo"}. 
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Figure 6: Constraint automaton of LossyFIFO with Data = {"foo"}. 

without loss of generality, we assume that if a = {Q,R,qo) denotes a CA, Q C Index (Footnote |3] still 
appUes). 

When we compose two connectors that have CA as their behavioral model, we can compute the 
CA of the composed connector by composing the CA of its constituents: the binary operator for CA 
composition takes the Cartesian product of the set of states of its arguments, designates the pair of their 
initial states as the initial state of the composed CA, and computes a new transition relation. 
Definition 22 (Composition of CA f6l). Let a\ = (2i,/?i,<7o) and tti = (G2,^2,9q) be CA over [Ni,Gi\ 
and [N2 , G2] ■ Their composition, denoted a\ txi a2, is a CA over [N\yjN2,Gi /\ Gijj defined as: 

ai M a2 = {Qi X Q2,R, {ql,ql)) 

{quFi,gi,q\) G/?i and (^2,f2,g2,^2) S /?2 1 



with:R={{{quq2).F,l^F2.g,^g2MW2)) and F,nN2 = F2nN, 

The previous definition differs slightly from the one in 1 6 ] : we do not implicitly assume that all states 
have a silent T-transition (as in f6l), but explicitly include these transitions in our models (represented by 
transitions labeled with (0, T)). Though essentially a matter of representation, it simplifies later proofs. 
Definition 23 (Composition of a-connectors). Let 'lo^'^ = {o\ , tti) and '^2^ = {02, 0C2) be CA connectors 



IS an 



over [Ni,Gi] and [N2,G2] such that Oi Ma2 is defined. Their composition, denoted 
a-connector over [Ni[JN2,Gi A G2] defined as: 

X = (^1 ^ ^2, tti M a2) 
To illustrate the previous definition, we depict the CA of LossyFIFO in Figure [61^ 

In the remainder, with a slight loss of generality, we consider only deterministic CA. We believe, 
however, that this limits the applicability of our results only marginally: in practice, non-deterministic 
CA occur rarely. In fact, even after almost a decade of research and literature on Reo, we have not 
encountered a (primitive) connector whose behavior one cannot describe concisely with a deterministic 
As a final remark, we emphasize that our presentation of CA remains superficial: we covered only 
the essentials relevant to the rest of this paper. A more comprehensive overview appears in 0. 



^For notational convenience, we write G\ A Gi for { gi A^2 \ S\ £ Gi and g2 £ G2 }. 

^Similar to the coloring model of LossyFIFO in Figure (4] its CA does not model its intended semantics: the transition 
(LFIFO-E, {A}, T, LFIFO-E) describes the inadmissible loss of data in the EMPTY state (similar to C24 in FigurejUl. 
^Many non-deterministic connectors, in contrast, do exist, but we can model their behavior with deterministic CA. 
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3 Data- Aware Coloring Models 

In this section, we make traditional coloring models data-aware by extending them with constraints 
similar to those carried by transitions of constraint automata. We introduce this extension, because one 
of the transformation operators that we define later in this paper lacks a desirable property otherwise: it 
would map many-to-one instead of one-to-one. More precisely, the transformation from a-connectors 
to £-connectors would map different a-connectors — i.e., those whose transitions carry different data 
constraints but equal firing sets — to the same £-connector. Alternatively, to gain this desirable one-to- 
one property, we could have narrowed the scope of this paper to a special class of CA whose members 
abstract from data constraints: the transitions of these port automata (PA) fTPl carry only a firing set. 
We favor the extension of coloring models for generality (note that CA subsume PA). 

We extend coloring models with data-awareness by associating each coloring with a data constraint 
from Constraint (recall from Definitions [19] and |20] that data constraints in CA come from the same 
universe). Such a constraint coloring describes a computation step of a connector wherein (i) data flows 
through the nodes marked by the flow color and (ii) the data constraint holds. Below we give the formal 
definition. With respect to notation, we write the symbols that denote constituents of data-aware coloring 
models infant (but use the same letters as for coloring models without constraints). 

Definition 24 (Constraint coloring). Let N C Node and G C Constraint A constraint coloring c over 
[N,G] is a pair {c,g) with c a coloring overN and g G a data constraint. 

Note that our definition does not exclude a constraint coloring c = {c,g) over [N,G] with inconsistent c 
and g. For example, c may mark some node n £N with the no-flow color, while g € G entails the flow of 
a data item d G Data through n. We do not forbid such constraint colorings, because they do not impair 
the models in which they appear: they merely describe behavior that cannot arise in practice. 

Next, we incorporate data constraints in the definitions of the other constituents of ordinary coloring 
models (as presented in Section 12.21 ). This turns out straightforwardly. To summarize the upcoming 
definitions: (i) a constraint coloring table is a set of constraint colorings, (ii) a constraint CTM is a map 
from indexes to constraint coloring tables, (iii) a constraint next function is map from [index, constraint 
coloring] -pairs to indexes, (iv) an initialized constraint next function is a [constraint next function, index] - 
pair, and (v) an e-connector is a formal model of a connector that has an initialized constraint next 
function as its behavioral model. 

Definition 25 (Constraint coloring table). Let N C Node and G C Constraint. A constraint coloring 
table T over [N,G] is a (sub)set (of) {N — ?> Color} x G of constraint colorings over [N,G]. 

Definition 26 (Constraint CTM). Let N C Node, G C Constraint, and A C Index. A constraint CTM S 
over [N,G,A] is a map A — )• 2^^^^°^°'^^^'^ from indexes to constraint coloring tables over [N ,G\. 

Definition 27 (Constraint next function). Let S be a constraint CTM over [N ,G,A\. A constraint next 
function t] over S is a partial map A x ({A'^ — > Color} x G) ^ A from [index, constraint coloring] -pairs 
to indexes such that [(A,c) i— )■ A'] G IJ iffc G 5(A). 

Definition 28 (Initialized constraint next function). Let S be a constraint CTM over [N,G,A\. An ini- 
tialized constraint next function £ over S is a pair (tj,/Io) with T] a constraint next function over S and 
AoGA. 

Definition 29 (e-connector). Let S be a constraint CTM over [N,G,A]. An E-connector over [N,S] 
is a pair (cJ,e) with a = {N,E) a connector structure and £ an initialized constraint next function over 
S. 
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S= < Sync i-> 



(ci, #A = #B) 
{C4, T) 



(ci, #A = #B) 



S= < LSync ^ < {cj, T) , 
I 1(C4,T) 



FIFO-Eh 
FIFO-Fh 



(c2, #A = "foo" 
(C4, T) 

(C3, #B = "foo" 
(C4, T) 



Figure 7: Constraint CTMs of Sync, LossySync, and FIFO with Data = {"foo"}. 



To illustrate the previous definitions, Figure |7] shows the constraint CTMs of Sync, LossySync, and 
FIFO. The colorings c, with / € {1,2,3,4} refer to the colorings in Figure [3l For instance, constraint 
coloring (ci,#A = #B) in the constraint CTM of Sync (respectively LossySync) describes the behavior 
alternative of Sync (respectively LossySync) wherein the same data item flows through A and B. Con- 
straint coloring (c4,T), present in all constraint CTMs, describes the behavior alternative wherein a 
connector idles. Due to the constraint T, this may always happen. Similarly, LossySync can always 
behave as described by (c2,T), but whereas (c4,T) entails no flow at all, (c2,T) entails flow through A 
and no flow through B. Here, T specifies that we do not care about which data item flows through A. 
With respect to FIFO, for simplicity of the example, we assume the universe of data items a singleton 
similar to Section 1231 In general, the constraint CTM of FIFO contains a distinct constraint coloring 
table for each data item in Data that may occupy the buffer. 

Finally, we must update the composition operators for coloring models to incorporate data con- 
straints. For brevity, we give these definitions only for constraint colorings and constraint coloring ta- 
bles. The composition operators for constraint CTMs (symbol: 0), (initialized) constraint next functions 
(symbol: (2»), and e-connectors (symbol: X) resemble their respective composition operators in Sec- 
tion [Z21 essentially, it suffices to replace S\, S2, T]2> £i> and £2 in Definitions [T41 - IT7] with their font 
versions Si, S2, TJ2' ^i' ^^d £2- We require only these minor updates, because our extension of 
coloring models with data constraints affects only the definition of colorings directly. For completeness, 
in Appendix |Al we give the definitions of those composition operators that we skip below. 

Definition 30 (Composition of constraint colorings). Let Ci = {ci,gi) and C2 = (€2,82) be colorings 
over [Ni,Gi] and [N2,G2] such that c\{n) = C2{n) for all n r\N2- Their composition, denoted by 
C\\JC2, is a constraint coloring over [NiUN2,G\ A G'^^ defined as: 

Ci UC2 = (Ci UC2,^l Ag2) 

Definition 31 (Composition of constraint coloring tables). Let T \ and T2 be constraint coloring tables 
over [N\,G\\ and [N2,G2]- Their composition, denoted by T\ - T2, is a constraint coloring table over 
[NiUN2,Gi A G2] defined as: 

Ti •T2 = {ciL)C2 \ Ci = {ci,gi) G Ti and C2 = {c2,g2) G ^2 andc\{n) = C2{n)for all n^N\ nA'^2} 

Note that the composition operator for CA in Definition |22] computes the label of a composite transition 
by taking the conjunction of two data constraints, similar to how we handle the combination of data 
constraints in Definition|30l The lemmas that we formulate and prove in the subsequent sections estabhsh 
the appropriateness of taking the conjunction of data constraints in the context of coloring models. To 
illustrate the previous definitions. Figure [8] shows the constraint CTM of LossyFIFO. The colorings c, 
with / G {12,24,43,44} refer to the colorings in Figured 

Recently, in [TT], Proen^a uses pairs of colorings and node-to-data functions as transition labels of 
his behavioral automata to account for the transfer of data that takes place through data-flows described 
by those colorings. This suggests using [coloring, node-to-data function] -pairs as a data-aware coloring 
model. However, our constraint-based extension offers a more concise formalization. For instance. 
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{ci2, #A = #MA#M = "foo") 



5= lfifo-eh-> {c24, 

I {C44, 



, LFIFO-Fm> 



(ci2, #B = "foo") 

(C24, T> , 

(C43, #B = "foo") 

(C44, T) 



Figure 8: Constraint CTM of LossyFIFO with Data = {"foo"}. We abbreviate (LSync,FIFO-E) by 
LFIFO-E and (LSync,FIFO-F) by LFIFO-F. 



in Proenga's model, to give the semantics of a Sync primitive, one must include a separate [coloring, 
node-to-data function] -pair in its coloring table for each data item in Data. With our constraint-based 
extension, in contrast, we capture this with a single constraint coloring as shown in Figure H 



4 From e- Connectors to a -Connectors 

In this section, we present a unary operator, denoted by L, which takes as argument an e-connector 
and produces an equivalent a-connector; shortly, we elaborate on the meaning of "equivalance" in this 
context. We call our process of transforming an £-connector to an a-connector the IL-transformation. 
By defining the L-transformation for any e-connector, it follows that the class of connectors that we can 
model as a-connector includes those that we can model as e-connector — i.e., constraint automata are at 
least as expressive as data-aware coloring models. 

The L-operator works as follows; suppose we wish to transform an e-connector 'tf'^°' = (cJ,e) over 
[N,S] with S a constraint CTM over [N,G,A]. Whereas the connector structure a does not incur any 
change (because L alters only the behavioral model), from the initialized constraint next function € = 
(ij , Ao) , the L-operator derives a constraint automaton. First, L instantiates the set of states of this derived 
CA with the set of indexes A: this seems reasonable as A denotes the set of indexes that represent the 
states of the connector that models. Next, L constructs a transition relation R based on the mappings 
in 17 : for each [(A, (c,g)) 1— A'] G TJ, the L-operator creates a transition from state A to state A', labeled 
with g as its data constraint and with the set of nodes to which c assigns the flow color as its firing set. 
Finally, Ao becomes the initial state of the new CA. 

Definition 32 (L for e-connectors). Let = (cJ,e) be an e-connector over [N,S\ with £ = (t],Ao) 
and S a constraint CTM over [N, G, A]. The "L-transformation of'^''°\ denoted by 'L{^'^°^), is defined as: 

L(^C'") = (a,L(€)) 

with: L(e) = (A,/?,Ao) 

and: R= { (A,F,g, 1] (A,c)) | A eh and c = {c,g) G S(A) and F = {n£N \ c{n) = }} 

The following proposition states that the application of L to an 77 -connector yields an a-connector. 
Proposition 1. Let be an e-connector over [N ,S\ with S defined over [N,G,A]. Then, L('^'^°') is an 
a-connector over [A'^,^]. 

Proof. Let = (a,e) with e = (t],Ao). Then, by Definition [3l L(<^'=°') = (a,L(e)) = 
(a, (A,/?, Ao)). By Definition 1211 we must show that (A,/?,Ao) is a CA over [N,G]. To demon- 
strate this, by Definition [20I we must show that /?CAx2^xGxA. Because, by the premise, is 
an e-connector over [N,S], by Definition[29l e is an initialized constraint next function over S, hence, 
by Definition l28l the co-domain of T] is A. Also, by Definition l32l for all (A,F,^, TJ (A,c)) G R with 
c = {c,g), it holds that A G A, F C A^, and g eG (this latter follows from Definition O. □ 

In the rest of this section, we prove the equivalence between an e-connector and the a-connector 
that results from applying L to Additionally, we prove the distributivity of L over composition. 
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4.1 Correctness of L 

In this subsection, we prove the correctness of L: we consider L correct if its application to an £- 
connector yields an equivalent a-connector. We call an e-connector and an a-connector equivalent if 
there exists a bi-simulation relation that relates these two connector models. Informally, an a-connector 
'^'-'^ is bi-similar to an e-connector if, for each mapping in the constraint next function of there 
exists a corresponding transition in the CA of 'la"-'^ — i.e., a transition that describes the same behavior in 
terms of the nodes that fire, the data items that flow, and the change of state — and vice versa. 

Definition 33 (Bi-simulation). Let = {a, a) with a = {Q,R,qo) be an a-connector over [N, G] and 
<if<=oi ^ (a,e) with e = (lJ,Ao) an e-connector over [N,S] with S defined over [N,G,A]. ^^'^ and 
are bi-similar, denoted as '^^'^ ~ if there exists a relation ^ C g x A such that {qQ,Xo) G ^ and 
for all e ^: 

(I) If {q,F,g,q') G R then there exists a X' € A (ll) If [(A,c) A'] G T] with c = {c,g) then 
such that: there exists a q' & Q such that: 

• [{X,c) ^ A'] G T] with c = {c,g); • {q,F,g,q') G /?; 

• {q\X')e^; • (^',A')G^; 

• F = {neN\ c{n) = }. • F = {neN\ c{n) = }. 

In that case, 1% is called a bi-simulation relation. 

Next, we formulate and prove Lemma[T] which states the bi-similarity between an e-connector and 
its L-transformation L('^'^°'). In our proof, we choose the diagonal relation on the set of indexes as a 
candidate bi-simulation relation. 

Lemma 1. Let be an e-connector Then, L(<^'='") ~ <^'='". 

Proof Let 'T'^"' = (a,e) with e = (r],Ao) be defined over [A^,5] with 5 defined over [A^,G,A]. Ad- 
ditionally, let L(<(f'^°') = (a,L(£)) with L(e) = (A,/?,Ao). We show that ^ = { (A, A) | A G A} is a 
bi-simulation relation by demonstrating that it satisfies (l) and (ll) of Definition [33] Let (A, A) G 

(I) Suppose {X,F,g,X') G R. Then, by Definition [32] of L. there exists a c = {c,g) G 5(A) such that 
A' = T](A,c). Hence, [(A,c) ^ A'] G rj. Also, by the definition ofS?, (A', A') G S?. Finally, by 
Definition [32] of h,F = {n£N\ c{n) = }. Therefore, M satisfies (l). 

(II) Suppose [(A,c) 1-^ A'] G T] with c = {c,g). Then, by Definition [27] of T], it holds that A G A 

andc G 5(A), hence by Definition [32] of L, (A,F,g,A') G/? withF = {neN \ c{n) = }. 

Also, by the definition of ^, (A', A') G ^. Therefore, ^ satisfies (ll). 

Thus, M satisfies (l) and (ll). Also, because Ao G A by Definition [28] (Ao,Ao) G Hence, ^ is a 
bi-simulation relation. Therefore, L('^'^°') ~ □ 



4.2 Distributivity of L 

We end this section with the distributivity (compositionality) lemma of L. Informally, it states that it does 
not matter whether we first compose e-connectors '^|*^°' and "^2^°' and then apply L to the composition or 
first apply L to "To^"^ and 'io2°^ and then compose the transformations; the resulting a -connectors equal 
each other. The relevance of this result lies in the potential reduction in the amount of overhead that it 
allows for when applying the L-operator in practice. This works as follows. There exist tools for Reo 
that operate on constraint automata and that have built-in functionality for their composition. By the 
distributivity lemma of L, to use such a tool, we need to transform Reo's common primitives only once, 
store these in a library, and use this library together with the built-in functionality for composition to 
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construct the CA of composed connectors (on which the tool subsequently operates). Thus, the overhead 
of this approach remains constant. In contrast, the overhead of the alternative — i.e., first composing 
coloring models and then transforming the resulting cornnosition using L — grows linear in the number 
of composed connectors one wishes to apply the tool on|f| In Section [6l we illustrate the foregoing with 
a concrete example; here, we proceed with the lemma and our proof, which, although rather technical, 
essentially consists of a series of straightforward applications of definitions that allow us to rewrite the 
transition relations of the composed automata. 

Lemma 2. Let and he e-connectors. Then, L(^f'") x hC^^"') = LC^f"' X "ff^"'). 

Proof. Let "^^'^ = {Oi,ei) and = (02, £2) with £1 = (t]i,AJ) and £2 = {112,^0) defined 
over [A'^ijSi] and [A'^2,'S'2]- Applying Definition [32] of L, Definition |23] of x, and Definition [39] of x 
(informally on page]93]) yields: 

((7iKa2,L(ei)ML(e2)) = (ai Ka2,L(ei (8>e2)) 

We focus on proving L(ei) tx L(e2) = L(ei £2). Applying Definition[32]of L to the left-hand side 
(LHS) and Definition [38] of ® (informally on pagel93]) to the right-hand side (RHS) yields: 



(Ai,/?i, Aj) 

CXI 



L 



(A2,/?2,A2) 

with:/?i = i (Ai,Fi,gi,T]i(Ai,Ci)) 



(Ai,A2),Ci UC2 

_ (T]i(Ai,ci), 172(^2,02)) 



(^1,^2) G Ai X A2 
and 

CiUC2G(Si052)((Ai,A2)), 



and:/?2 = \ (^2,^^2,52, T?2(^2,C2)) 



Ai G Ai and Ci = {ci,gi) G 51(^1) and 
Fi={neNi \ci{n) = } 

A2 G A2 and C2 = {€2,82) G Si (A2) and 
F2 = G A^2 I C2{n) = } 

Applying Definition [22] of to the LHS, and Definition [32] of L to the RHS yields: 

(Ai X A2,/?,(AJ,A2)) = (Ai X A2,/?',(Ao',A2)) 

{XuFugiM) G/?i and (^2,^2,^2,^^) G/?2 
andFinA^2 = ^2nM 

A gAi X A2 andc = (c,g) G (Si052)(A)| 
and F = { « G M U A^2 I c{n) = } J 

What remains to be shown is R = R'. This follows from Figure [9] 



with: R 



and: R' 



((Ai,A2),FiUF2,giAg2,(Ai',A^)) 

(A,F,g,(t]l0Tj2)(A,t)) 



□ 



Although we consider only coloring models with two colors in this paper, one can apply Definition 
[32] of L also to 3-colored £-connectors. In fact. Lemma [T] (bi-simulation) would still hold! Essentially, 
this means that 3-colored £-connectors do not have a higher degree of expressiveness than coloring mod- 
els with two colors. In contrast. Lemma [2] (compositionality) does not hold if we consider 3-colored 
e-connectors. More precisely, the fourth — counted from top to bottom — equality in Figure[9]("Because, 
by the definition of Fi and F2...") becomes invalid if we consider coloring models with three colors. 
This means that, although coloring models with two and three colors have the same degree of expres- 
siveness, they compose differently: paradoxically, the addition of a third color restricts, as intended, the 
number of compatible colorings. This allows us, for instance, to describe compositional context-sensitive 
connectors with three colors (considered impossible with two colors). 



^In the current exposition, we assume composing two e-connectors and two a-connectors have equal costs. In Section [6] 
we argue for the merits of our approach when the cost of coloring model composition differs from the cost of CA composition. 



S.-S.T.Q. Jongmans & F. Arbab 



97 



(A,fiUf2,glAg2=W,A^)) 



{x,FiUF2,g,Ag2,{^,^)) 



R 

'- /" By the definition of R in Lemma 13 

{{{luh),PiOp2,gi/\g2,{K,^.)) I (Ai,Fi,g,,Ai'> GRi and (^2,^2,^2, e K2 and Fi nWj = ^2 } 
'- /* By the definitions of Ri and R2 in Lemma |21 and by introducing A = (Ai,A2) ,/ 

Ai G Ai and ci = (ci,gi) € S'i(Ai) and X[ = l),(Ai,ci) and Fi = {n e Ni \ ci(n) = 
h e A2 and C2 = {c2,gi) G S2(A2) and A^ = T/2(A2, C2) and F2 = { « e ^2 1 qC") = 
Fi nN2 = -F2 nWi and A = (Ai, A2> 
Because, by the Cartesian product, [Ai E Ai and A2 £ A2] iff {A| . A2) e Ai x A2 

Ci = (ci,gi) e Si(Ai) and A[ = »J,(Ai,Ci) andfi = {n<=N[ | C|(«) = } and 

1^2 = {c2,g2) e S2(A2) and ?J, = J}2(A2,C2) and ^2 = {" G -^2 I C2(n) = } and 

F, nW2 = -F2nA'i and A = (Ai,A2) G Ai x A2 
/* Because, by the definition of Fi and F2 in Lemma |2 [fi r\N2 = F2r\Ni] iff [{neN\ nN2 | ci(;i) = 

} = { M 6 Wi 0^2 I C2{n) = }], and because, as ci and C2 are 2-colorings, [{n € NiD 

N2 I c,{n) = } = {,! eA'i nN2 I C2(;!) = }] iff [ci{ii) = C2{n) for all neN, nyVi] 

C| = £ Si(Ai) and A,' = l]i(Ai,Ci) andFi = {n eW, | ci(«) = } and 

C2 = (c2,g2) G S2(A2) and A^ = 7}2(A2,C2) and F2 = {« G ^2 | C2(«) = } and 

[ci (n) = C2 (n) for all « e n ^2] and A = (Ai , A2) G Ai x A2 
Because, by Definition |22 of [ci = (ci.gi) g5i(Ai) and C2 = (c2.g2) G 52{A2) and c\{n) = 
(n) for all ;r e ^0^2] iff [c, Uc2 G 5i{A|) ■52(A2)] ,/ 

ci = (ci,gi) and AI = l)i(Ai,Ci) andfi = {n | ci(n) = } and "I 

C2 = (c2>g2) and A^ = 7)2(^2, C2) and F2 = {« G ^2 | C2(«) = } and > 

Ci UC2 G 5i(Ai) ■S2(A2) and A = (Ai,A2) G A| x A2 J 
of (informally on page 123) .:/ 

= and A[' = lJi(Ai,Ci) and Fi = {n e Ni \ ci{n) = } and ^ 

•^2 = (c2jg2) and A^ = 1J2(A2,C2) and ^2 = {« G ^2 | C2(«) = } and > 

C1UC2 G (Si0S2)(A) and A = (A|,A2> G Ai x A2 J 
/* Because, by Definition E7]of ® (informally on page|H3), [A = (Ai.Ai) G A| x A2 and C| UC2 G 
{Si 0S2)(A) and A,' = TJifAi.c,) and ^ = ri2{h-C2)] iff [(A,'.A^> = (?J , JJ2)(A,£-, UC2)] ,/ 

ci = (ci,gi) and Fi = { ?i G M | ci(«) = } and ^ 

<^2 = (c2.g2) and F2 = { « G ^2 I C2(ji) = } and > 



■ } and 
■ } and 



{A,F,UF2,gi Ag2,(Ai',A;)) 

Because, by Definition HI 
(n) for all ;rGWinA'2] iff [c 

(A,F,Uf2,gi Ag2=(Ai',A^)> 

By Definition 

(A,FiUf2,gi Ag2,(Ai',A^)) 



(A,F,UF2,giAg2,(A(,A^)) 
By introducing F 
(A,F,gi Ag2,(j?,0J]2)(A,CiUC2)) 



C1UC2 G (Si©52)(A) and A G Ai x A2 and (AI.AJ) ^ 
Fi UF2, and by applying (ApA,) = (rj, 0J)2)(A.Ci UC2) »/ 
ci = (ci,gi) andC2 = (c2,g2> and 
F = {neNiUN2 I Clin) = or C2(n) = 



(jJl<8l»?2)(^^ClUC2) 



■ } and 



C1UC2 G (Si©S2)(A) and A G Ai X A2 J 

/* Because, by Definition [I2]of U, [ci(«) = or C2(n) = ] iff [(c, Uf2)(") = ]. and 

by applying (eg) = c = C| UC2 = (f| Uc2,gi Ag2) ./ 

{ (A,F,g, (ni ® 'J2)(^,c)) \F = {neNiUN2\ c(n) = } and c = (c,g> G (Si ©S2)(A) and A G Ai x A2 } 

/* By the definition of R' in Lemma |2|»/ 
R' 



Figure 9: Proof: R = R'. 



5 From a-Connectors to e-Connectors 

In this section, we demonstrate a correspondence between e -connectors and a -connectors in the direc- 
tion opposite to the previous section's: from the latter to the former. Our approach, however, resembles 
our approach in Section ID we present a unary operator, denoted by which takes as argument an 
a-connector and produces an equivalent — i.e., bi-similar — e -connector. We call our process of trans- 
forming an a-connector to an 77-connector the j^-transformation and define the j;-operator for any a- 
connector. It follows that the class of connectors that we can model as a-connector includes those that 
we can model as £-connector. Since the previous section gave us a similar result in the opposite direction, 
we conclude that £-connectors and a-connectors have the same degree of expressiveness. 
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The operator works as follows; suppose we wish to transform an a-connector 'rf'^'^ = {<J,(x) over 
[A'^,G]. Whereas the connector structure a does not incur any change (because alters only the behav- 
ioral model), from the CA a, the j^-operator derives an initialized constraint next function: for each 
transition {q,F,g,q') in the transition relation of a, includes a mapping from state q and a constraint 
coloring c = {c,g) to state q', where c assigns the flow color to all and only nodes in F. 

Definition 34 (col). LetN,F C Node. Then: 

ifneF \ 



col{N,F) = ^n^K 



n GN and K - 



■ - otherwise J 



Definition 35 (j^ for a-connectors). Let '^'^'^ = {o,a) be an a-connector over [N , G] with a = {Q,R, qo) 
a CA over [N ,G\. The j^-transformation of^^"^, denoted by Y.i^^'^), is defined as: 

l(^-) = (a,l(a)) 
with: l{a) = {■q,qo) 

and:ri = {{q,{col{N,F),g))^q' \ {q,F,g,q') e R} 

The following proposition states that the application of |^ to an a-connector yields an £-connector. 

Proposition 2. Let ^^'^ = (cJ,a) be an a-connector over [A'^jG]. Then, j-('^'^'^) is an e-connector over 
[N, S] with S defined over [N, G, Q] as: 

S={q^T \qeQandT = {{col{N,F),g) \ {q,F,g,q') e R}} 

Proof. Let = (a, a) with a = {Q,R,qo) a CA over [N,G]. Then, by Definition [35l = 
((7, j^(oi)) = (lJ,^o)- By Definition |29j we must show that TJ is a constraint next function over S. 
First, by Definition [34l all colorings that occur in the domain of TJ have N as their domain. Next, 
by Definition [35l all indexes that occur in the domain and co-domain of t] are states that appear in 
elements of the transition relation R; therefore, by Definition [20l all indexes come from Q. Similarly, 
by Definition |35l all data constraints that occur in the domain of IJ also appear in elements of R, 
hence come from G. Finally, by Definition [27J we must show that [(A,c) i-^ A'] G TJ iff c G 
This follows straightforwardly from Definition [35] and the definition of S in this proposition. □ 



5.1 Inverse 

Having defined j^, we proceed by proving that it forms the inverse of L (as already hinted at by its symbol) 
and vice versa. We do this before stating the correctness of j- and its distributivity over composition, 
because the proofs of these lemmas become significantly easier (and shorter) once we know that 
inverts L. The following two lemmas state the inversion properties in both directions. 

Lemma 3. Let "tf^"' be an e-connector Then, J;(L('^'='")) = 

I Proof. Let = (a, e) be defined over [A^, S] with S a constraint CTM over [A^, G, A]. By Definitions 
|29l[^ and[35l we must show that i;(L(e)) = e. This follows from Figure[Tni □ 

Lemma 4. Let ^^'^ be an a-connector Then, L(^(^^'')) = 'T'^'^. 

|i Proof Let = (a, a) be defined over [A^,G]. By Definitions ED [22 and[35l we must show that 
L(j;(a)) = a. This follows from Figure [TT] □ 



S.-S.T.Q. Jongmans & F. Arbab 



99 



— I' By Definition E21of L, and because e is defined over S, which is defined over \N,G,t\\ ,/ 

j;((A,«,Ao)) with as in Definition l32l 
~ /* By Definition |35] of j-, and because L(e) is an a-connector over [A',G] by Proposition [T] ^/ 

({(A,(col(Af,F),g)) h^-A' I eR},Ao> with R as in Definition ESI 

= /' Because (A.F.g.A') GR iff [A G A and c= (f,g> G 5(f/) and 

F = GW I c(n) = } and A' = 7j(A,c)] by Definition of L „,/ 

({(A,{col(A',F),g)> i-s> jj(A,c) I A GAandc= (c,g) eS(A) andF = {«GA' | c{n) = }},Ao> 

= /' Because c = col(yV.F) iff F = { ;? G W | c{n) = } by Definitions Island Il4l ,,/ 

({ (A, {c,g» ^ 7}(A,c) I A G A and c = {c,g) G S(A) }, Ao) 
= /* By Definitions 1771 and 1^ ,,/ 



Figure 10: Proof: liMe)) = £. 



5.2 Correctness and Distributivity of 

As mentioned previously, knowing that L(|^(^^'^)) = '^'-'^ (with ^'-'^ an oi-connector) greatly simplifies 
our correctness and distributivity proofs. We start with the former. Lemma[5l which appears below, states 
the bi-similarity between 'W^'^ and its -transformation In addition to the inversion lemma, in 

our proof, we apply the bi-similarity lemma of L. 

Lemma 5. Let be an a-connector. Then, '€^'^ ~ eC^^'^)- 

I Proof. Let = ^(^^''). Then, ~ e(^'"') ^-(eC^")) ~ H"^^^) iff L(<r^°') ~ <^^'" by 
I LemmaH The latter, L(^'='") ^ follows from Lemmaffl □ 

Finally, Lemma [6] states the distributivity of |^ over composition: informally, this means that it does not 
matter whether we first compose a-connectors ^^'^ and '102'^ and then apply to the composition or first 
apply 1^ to 'la^'^ and '^02'^ and then compose the transformations; the resulting £-connectors equal each 
other. Our proof, similar to that of the previous lemma, relies on the inversion lemmas. 

Lemma 6. Let ^f'^ and "i^" he a-connectors. Then, ^(^i") X e(^2") = eC^i" ^ '^2")- 

I Proof. Follows from Figure [ID □ 

6 Application 

In this section, we sketch an application of the results presented above: the integration of verification 
and animation of context-sensitive connectors in Vereofy |5|, a model checking tool for a-connectors 
that operates on constraint automata]^ Broadly, this application consists of two parts: model checking 
connectors built from context-sensitive constituents and generating animated counterexamples. 

Verification of £-connectors Vereofy operates on constraint automata and, therefore, many consider 
it unable to verify context-sensitive connectors. We mend this deficiency as follows. First, we note that 
recent research established that one can transform coloring models with three colors, known for their 
ability to properly capture context-sensitivity, to corresponding coloring models with two colors ifTOl . 
Essentially, this means that e-connectors as defined in this paper — i.e., featuring only two colors — can 

''Vereofy is freely available on-line at: http : //www . vereofy . de] 
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L(f(a)) 




j''' By Definition 1351 of j^, snd because d = {Q.R.qo) is a constraint automaton over [A'^.O] by the 




premise of Lemma l4l , / 




Hin^'lo)) witn 7} — {{q, (coHA',/^ J,g}} q \ {q,t ,g,q ) ^ K\ 




~ /' By Definition 1321 of L, and because f] is defined over 5 with 




i> — \q < — r 1 |£/tyanoi — | (^co± (iv . t j^x} \q^r ,g^q j tiv|| oy r roposition z ^ / 




{Q,R',qo) with: 




• R — 1 W;^!^! ^ WiCj; •5' e y and c = {c.g) ^ o[q) and t = \ n ^ N \ c[n) = ) | 








• S = ^ a \-^T \ a G O and T = 1 /col('/V 1 ('(7 F p i?'') F H 




/* By introducing ly' — 7\{q.c') in i?' ^/ 




(Q,R',qo} with: 




• /\ — ^ \^£^. r .g^q I t/t i^yaiiLic — \c^gi oyq j diiu — ^/itiv \ c\^fi j — j diiu q — ifyq^cjy 




• n = / (col(N F) e)) ^ a' \ (a F s a') G R \ 




. S={q^T\qeQandT = {{col(N,F),g) | {q,F,g,q') e R}} 




= /* Because, by the definition of S, [c = (eg) e S{q)] \it [(q.F' .g,q") e R and c = col{N,F')] J 




(Q,R',qo) with: 




• R' = { {q,F,g,q') | ^ £ Q and {q,F',g,q") e R and c = col{N,F') and F = {neN \ c{n) = } and 9' = 




. r] = {{q,{col{N,F),g)) ^q' | {q,F,g,q') E R} 




1'" By applying f = col(A'.F') , /' 




. R' = { (<l,F,g,4) 1 g e G and {q,F' .,g,q") G R and F = { ,r e W | (col(7V,F'))(n) = } and q' = r}{q, {col{N,F'),g)) } 


. rt = {{q,{col{N,F),g)) ^q' | (^,F,g,?') e R} 




/• Because, by Definition El of col, {iieN\ {col{N.F'))(n) = } = F' „/ 




{Q,R',qo) with: 




• R' = {{q,F,g,q') | 9 £ G and {q,F',g,q") G R and F = F' and?' = r](q,{col{N,F'),g))} 




. IJ = { (9, (col(W,F),g» ^ 4 1 (ci,F,g,4) G R } 




/' By applying F = F' .^j 




(Q,R',qo) with: 




• R' = {{q,F',g,q') | ? G G and {q,F',g,q") G R and = T/(?, (col(W,F'),g)) } 




. JJ = {(?,(col(W,F),g» 1 {q,F,g,q')eR} 




= /* Because, by the definition of JJ, (/' = Tj((7, (coKW.F').,?)) ift {q.F' .g.q') e R ,/ 




(Q,R',qo) withR' = { {q,F',g,q') \ q e Q and {q,F\g,q") G R and {q,F' ,g,q') ER} = R 




= / ' By the definition of a ,/ 
a 





Figure 11: Proof: L(j;(a)) = a. 



serve as faithful models of context-sensitive circuits. Consequently, the results in Section |4] enable the 
verification of such connectors with Vereofy: using the L-transformation, we transform context-sensitive 
e-connectors to context-sensitive a-connectors, whose CA we subsequently can analyze with Vereofy. 
In this application, the distributivity of L over composition in Lemma |2] plays an important role (as 
already outlined in Section 14^21 ): it facilitates (i) the one-time-application of L to the context-sensitive 
e-connectors of Reo's primitives after which (ii) we can use Vereofy's built-in functionality for CA 
composition to construct the complex automata that we wish to inspect. Examples appear in ifTOl . The 
distributivity lemmas work also in the opposite direction: if future studies indicate that composition of 
coloring models costs less than composition of CA, we may extend Vereofy with a module to automat- 
ically (1) transform CA of primitives to coloring models with j^, (2) compose the resulting coloring 
models, and (3) transform the resulting composition back to a CA with L. (To truly gain in performance, 
however, the costs of transforming forth and back should not exceed the benefits of composing coloring 
models instead of CA.) 
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~ I' By the inversion of L by j- in Lemma O »/ 

_ E(L(,t(^r) X eC*?*))) 

= /* By the distributivity of L over composition in Lemma |2] »/ 

i(L(l(^n)xL(lCgJ*))) 
~ /* By the inversion of |- by L in Lemma |4| ,,/ 



Figure 12: Proof: rC^i") x e('^2") = ^ '^2"')- 



Animation of a -connectors Vereofy facilitates the generation and inspection of counterexamples, an 
important feature that distinguishes it from mCRL2 (another tool sometimes used for model checking 
Reo circuits 111)0 When using Vereofy in conjunction with the Eclipse Coordination Tools (Reo's 
standard distribution) it can in some cases display counterexamples as connector animations. These 
animated counterexamples comprise a graphical model of a connector (similar to Figure[Tl) through which 
data items visually flow for each computation step of a faulty behavior. Although this approach greatly 
enhances the ease with which users can analyze counterexamples, the opportunity to actually provide 
these animations depends on the availability of a coloring model of the connector under investigation (in 
addition to the constraint automaton that Vereofy's verification algorithm operates on). Moreover, the 
standalone version of Vereofy, a command-line tool, does not facilitate the animation of counterexamples 
at all. The results in Section [51 however, enable animated counterexamples for any CA: in the case of 
unavailability of a coloring model, Vereofy can simply generate such a model with the -transformation. 



7 Concluding Remarks 

Related work Closest to the work in this paper seems an informal discussion in lH |9l on the equiva- 
lence of coloring models and constraint automata. These cited references, however, do not support their 
claims with formal evidence, nor do they provide an algorithm, operation, or function to actually trans- 
form connector models back and forth. More generally, we know of only a few other correspondences 
between different semantic models of Reo connectors, the oldest concerning CA and coalgebraic mod- 
els: the set of runs of an a-connector '^'^'^ corresponds to the set of timed data streams induced by the 
coalgebraic model of the same circuit that '^^'^ models (Definition 3.6 in [6]). Reo's semantics in terms 
of the unifying theories of programming [13 ] appears closely related to the coalgebraic semantics as well, 
but we do not know of any formal claims or proofs. Two other correspondences concern tile models IS 
and coloring models: Arbab et al. prove in Theorems 1 and 3 of |3| that a semantic model based on 
tiles, which resemble colorings, yields behavioral formalisms equal to coloring models with two or three 
colors (depending on the tile definitions). 



Conclusion and future work We showed that, once extended with data constraints, coloring models 
with two colors and constraint automata have the same degree of expressiveness by defining two op- 
erators that transform data-aware coloring models to equivalent CA and vice versa. Moreover, these 
operators distribute over composition, a desirable property especially from a practical point of view. 
Though primarily a theoretical contribution, we illustrated how our results can broaden the applicability 



mCRL2 is freely available on-line at: http : //www . mcrl2 . org 



'^The Eclipse Coordination Tools are freely available on-line at http : / /reo . pro j ect . cwi . nl [ 
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of Reo's tools. With respect to future work, we would like to implement the transformation operators and 
the sketched extension to Vereofy. Another application worth investigation comprises the development 
of an implementation of Reo based on transforming the behavioral models of connectors back and forth. 
Finally, we would like to study correspondences between other semantic models (e.g., guarded automata 
171 and intentional automata |[9l). 

Acknowledgments We would like to thank the reviewers and the members of the ICE 201 1 discussion 
forum gege, wind, wolf and xyz for their valuable comments. 
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A Appendix: Composition Operators 

In this appendix, we give the formal definitions of the composition operators whose definition we gave 
only informally in Section [3] More specifically, we give the definitions of the composition operators 
for constraint CTMs, (initialized) constraint next functions, and e-connectors. The definitions of the 
composition operators for constraint colorings and constraint coloring tables appear in Section [3] As 
mentioned in that section, we obtain the operators that we define below by replacing Si, S2, Tji, 772, £1, 
and £2 in Definitions [T4] - [r7] by their font versions Si, S2, I]i, 1)2, £1, and Ej- 

Definition 36 (Composition of constraint CTMs). Let Si and S2 be constraint CTMs over [N\,G\, Ai] 
and \N 2, G 2, A2\. Their composition, denoted by S i Q S2, is a constraint CTM over [N\\JN2,G\ /\G2,A\ x 
A'^^ defined as: 



Definition 37 (Composition of constraint next functions). Let IJj and be constraint next functions 
over Si and S2 with Si and S2 constraint CTMs over [A'^i,Gi,Ai] and [A'^2;G2, A2]. Their composition, 
denoted by T} i®T}2, is a next function over S\ © S2 defined as: 



Definition 38 (Composition of initialized constraint next functions). Let £1 = (t] j , Aq ) and £2 = (^7 2' ■^o ) 

be initialized constraint next functions over S\ and S2. Their composition, denoted by E2, is an 
initialized next function over [Si ©S2] defined as: 



Definition 39 (Composition of e-connectors). Let "^f"' = (01,61) and '^2^°' = (02,62) be E-connectors 
over [N\,S\\ and [A^2)S2] such that a\ M 02 is defined. Their composition, denoted by ^1°' x ^2^°', is an 
E-connector over [Ni UN2,Si QS2] defined as: 



5j©52 = {(Ai,A2)^Si(Ai)-S2(A2) | Ai gAi WA2GA2} 



TJl (8)T]2 = < 




61 (8)62 = (i?i 0172, (A( 




C/i>Co\ w C^C 

w Y X ^2 



(ai ^02,61 ©62) 



